Low severity · published Oct 1, 2026
CVE-2026-66248
HCL iControl is affected by an Improper Error Handling vulnerability
3.1
CVSS
0.2%
EPSS
No
On KEV
Description
iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to plan advanced targeted attacks.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
iControl · HCL Software
v4.5.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-66248
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-66248
support.hcl-software.com
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133940
More from iControl
8.8
CVE-2026-66246
HCL iControl is affected by multiple security vulnerabilities
5.3
CVE-2025-62340
HCL iControl was affected by Inadequate Session Timeout vulnerability
4.3
CVE-2026-66247
iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malicious website to execute cross-origin requests with included…
3.1
CVE-2026-66253
HCL iControl is affected by a Session Timeout vulnerability
3.1
CVE-2026-66249
HCL iControl is affected by a Missing Secure Attribute vulnerability